A critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks’ GlobalProtect VPN is now under active exploitation, according to both Palo Alto Networks and Rapid7. This flaw allows attackers to potentially establish unauthorized VPN connections and gain access to corporate networks.
What Happened
Palo Alto Networks initially disclosed CVE-2026-0257 earlier in May, assigning it a Medium severity rating. However, the discovery of active exploitation, first observed by Rapid7 on May 17, 2026, prompted an immediate escalation to High severity. The vulnerability exists within the GlobalProtect portal and gateway of PAN-OS software. It’s triggered when devices are configured with authentication override cookies enabled and a specific certificate configuration is in place.
Rapid7’s investigation identified attacks originating from infrastructure hosted by Vultr and Dromatics Systems. Attackers are leveraging forged authentication override cookies targeting the local administrator account. While not all attempts result in a full VPN session, successful exploitation grants attackers access to internal networks. The root cause is a failure to properly validate authentication override cookies; GlobalProtect decrypts these cookies using a private key but doesn’t verify their signature.
This lack of signature verification is particularly dangerous if the same certificate is used for both HTTPS services and authentication override cookies. An attacker can then retrieve the public key via an HTTPS session and use it to forge valid-looking cookies, bypassing authentication. Rapid7 has published a proof-of-concept (PoC) exploit demonstrating this attack vector.
Why It Matters
This vulnerability poses a significant risk to organizations relying on GlobalProtect VPN for secure remote access. A successful exploit bypasses standard authentication mechanisms, enabling unauthorized access to sensitive internal resources. The fact that exploitation is already occurring in the wild – and was observed starting more than two weeks ago – underscores the urgency of addressing this issue.
For developers, this highlights the importance of robust cryptographic validation. Simply decrypting a cookie is insufficient; proper signature verification is essential to prevent forgery. This also underscores the risk of certificate reuse across different services, as it expands the attack surface.
Enterprise IT teams should prioritize patching vulnerable GlobalProtect VPN devices. The CISA (Cybersecurity and Infrastructure Security Agency) has added CVE-2026-0257 to its Known Exploited Vulnerability (KEV) catalog, mandating federal agencies to mitigate the risk by June 1, 2026. Even without this mandate, organizations should act swiftly.
What To Watch
Organizations should immediately implement one of the following mitigations:
- Patching: Apply the latest security updates provided by Palo Alto Networks.
- Disable Override Cookies: Turn off the authentication override feature if it’s not required.
- Dedicated Certificates: Utilize a separate certificate specifically for authentication override cookies, preventing reuse with other services.
It remains to be seen what the full scope of the exploitation will be, and whether attackers have successfully moved laterally within compromised networks. Monitoring for suspicious activity and reviewing VPN logs for unauthorized access attempts is crucial. Further analysis of attack patterns and attacker tactics will also be important to understand the full extent of the threat.